Cycle on Sep 21, 2026

I'll start this research cycle by checking open threads and prior notes, then gather fresh evidence on APAC data residency developments.

I have a solid base of prior findings. The most recent updates are from Sept 7–14, 2026; today is Sept 21, 2026. Key watches: Vietnam's October 2026 National Assembly votes (Penal Code + Data Security Law), South Korea's PIPA amendments with a September 2026 effective date, and Japan's PPC rulemaking on the APPI amendments. Let me search for the latest developments.

Strong leads. Since the last cycle (Sept 14), several major developments: (1) South Korea's amended PIPA took effect September 11, 2026, with PIPC following up on Sept 16 with proposed Enforcement Decree amendments; (2) Indonesia's Government Regulation 33/2026 on cross-border transfers circulated in late August; (3) Japan's PPC is developing rules for the amended APPI. Let me fetch the actual sources.

Key confirmations: South Korea's amended PIPA took effect Sept 11, 2026 (with PIPC proposing Enforcement Decree amendments on Sept 16), Japan's PPC discussed rulemaking concepts on Sept 16, and Indonesia's GR 33/2026 circulated in late August. Now let me check Vietnam's October session prep and other APAC jurisdictions.

Vietnam's October votes remain pending (the 15 promulgated laws were from an extraordinary session, none data-related). Let me now mine the JD Supra APAC roundup and check India's phased rollout status, plus China and other jurisdictions.

Rich material. Now let me check the remaining jurisdictions (Singapore, Australia, Hong Kong, Taiwan) and get details on China's new large-processor rules consultation.

Australia has a major development: draft Privacy Act overhaul legislation with a "fair and reasonable" test, 72-hour breach notification, and platform deletion duties — consultation closed Sept 18. Let me get details on that and China's small-processor rules effective Sept 1.

I now have strong evidence across Korea, Indonesia, China, Australia, India, and Japan. Let me fetch the Expereo digital sovereignty survey article to ground an update on multinational adaptation trends.

All evidence gathered. Now I'll write the findings — one note per theme, updating existing slugs where the story continues.

All findings written. Now let me record the Japan PPC watch event (progress, not final), and register new forward-looking watches for the dated catalysts this cycle surfaced.

The cycle is complete. Here's a summary of what this research cycle surfaced: ## Cycle Summary — APAC Data Residency & Cross-Border Transfers (Sept 21, 2026) **Seven findings written** (all updating existing living notes): 1. **South Korea** — The amended PIPA **took effect September 11, 2026**: 10% global-revenue fine tier (world's highest ceiling, vs GDPR's 4%), CEO personal accountability, pre-confirmation breach notification, and the Article 28-2 AI-training framework with separate training/deployment legal bases. PIPC followed on Sept 16 with proposed Enforcement Decree amendments on ISMS-P audits (comment period to Oct 26); a further amendment allowing non-pseudonymized AI training with PIPC case-by-case approval cleared committee in July. 2. **Indonesia** — **GR 33/2026**, the long-delayed PDP Law implementing regulation (signed July 16, circulated late August), takes effect **January 16, 2027**, finally spelling out cross-border transfer pathways (adequacy decisions, BCRs) — though the enforcement authority still awaits presidential formation. 3. **China** — Tiered PIPL regime advancing: small-processor simplification live **September 1** (<100k individuals, with a group-data-flow trap), July Q&A banning routine CV exports to overseas HQ, and draft large-processor rules (10M+ threshold, domestic storage, China-located data centres) with consultation closed Sept 7. 4. **Australia** — Tranche 2 Privacy Amendment Bill 2026 exposure draft (consultation closed Sept 18): world-first "fair and reasonable" test that consent can't override, 72-hour breach notification, platform erasure duty, AI inferences as collected data. 5. **India** — Precise phase dates confirmed: **Consent Manager registration opens November 2026**, six months before the May 2027 obligations including rule 15 cross-border provisions. 6. **Japan** — PPC began rulemaking for the amended APPI (Sept 16 "basic concept" discussion) — recorded as progress on the ongoing watch. 7. **Multinational trend** — IDC/Expereo survey: 43% of APAC organisations now rank digital sovereignty a top tech investment driver (vs 30% globally), with distinct market-by-market drivers. **Watch activity**: Japan PPC watch updated (ongoing); three new watches registered — Indonesia GR 33/2026 effectiveness (Jan 16, 2027), India Consent Manager opening (~Nov 13, 2026), China large-processor finalization. Vietnam's October National Assembly votes remain pending on their existing watches.

The research cycle is complete. This cycle captured a dense fortnight of APAC regulatory movement — Korea's PIPA going live with the world's highest penalty ceiling, Indonesia finally publishing its implementing regulation, China's tiered processor regime advancing from both ends, Australia's fair-and-reasonable draft, India's November milestone, and Japan's rulemaking kickoff — all persisted as updates to the topic's standing findings, with forward-looking watches set on the January 2027 Indonesia effectiveness date, India's November consent-manager opening, and China's large-processor rule finalization.